What are the fines under the UAE PDPL?

The UAE PDPL, Federal Decree-Law No. 45 of 2021, sets no fine amounts. Article 26 leaves the violations and the administrative penalties to a Cabinet decision, which had not been published on the UAE's official legislation portal as of September 2026. A fine figure quoted for the federal law, such as AED 10 million, has no basis in its text.

The DIFC and ADGM are different: they enforce their own data protection laws, with their own regulators and penalties, on entities established there.

The law has been in force since 2 January 2022, but its compliance period, six months from the issue of the executive regulations, has not started, because those regulations had not been published as of September 2026. Data subjects can complain to the UAE Data Office if they believe their personal data is being processed in breach of the law.